Vulnerability in Oracle E-Business Suite's Purchasing Component
CVE-2026-87127

7.7HIGH

Key Information:

Vendor

Oracle
Status
Oracle Purchasing
Vendor
CVE Published:
15 September 2026

What is CVE-2026-87127?

A vulnerability exists in the Purchasing component of Oracle's E-Business Suite that enables a low-privileged attacker with network access via HTTP to compromise the system. This vulnerability may not only impact the Purchasing component but can also affect other products within the suite due to a possible scope change. If exploited, it can lead to unauthorized access to sensitive data, potentially allowing attackers to retrieve all data accessible through Oracle Purchasing.

Affected Version(s)

Oracle Purchasing 12.2.10 <= 12.2.15

References

https://www.oracle.com/security-alerts/cspusep2026.html
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.